CVE-2026-42062: Command Injection in ELECOM WRC-BE72XSD-B

The impact of this vulnerability is severe. Because no authentication is required, any attacker with network access to the access point can exploit it. Successful exploitation allows an attacker to execute arbitrary OS commands on the device, effectively gaining complete control. This could involve installing malware, stealing sensitive data (configuration files, user credentials stored on the device), modifying system settings, or using the access point as a pivot point to attack other systems on the network. The blast radius extends to any systems accessible from the compromised access point, making it a high-priority security concern.

1. Gereserveerd2026-05-07
2. Gepubliceerd2026-05-13

Given the lack of a currently available patch, immediate mitigation steps are crucial. Implement strict network segmentation to isolate the WRC-BE72XSD-B access point from critical systems. Consider using a Web Application Firewall (WAF) or proxy server to filter incoming requests and block those containing suspicious characters or commands in the username field. Monitor network traffic for unusual activity, particularly attempts to execute commands. Regularly review access point configurations and disable any unnecessary services. Once ELECOM releases a patch, apply it immediately. After upgrade, confirm by attempting a command injection attack via the username parameter; it should be rejected.